feat(ui):

apps/edr-freight-api/src/modules/auth/list-users.service.ts

@@ -1,4 +1,5 @@
 import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
 import { InjectRepository } from '@nestjs/typeorm';
 import { PaginatedResponse } from '@edr/types';
 import { User } from '@tria-plc/iamapi-common/entities/iam/user/user.entity';
@@ -19,6 +20,7 @@ import { paginateQuery } from '../../common/utils/pagination.util';
 export class ListUsersService {
   constructor(
     @InjectRepository(User) private readonly users: Repository<User>,
+    private readonly config: ConfigService,
   ) {}
 
   findAll(query: ListUsersQueryDto): Promise<PaginatedResponse<User>> {
@@ -40,6 +42,29 @@ export class ListUsersService {
       ])
       .orderBy(`user.${sortBy}`, query.sortOrder ?? 'ASC');
 
+    // Restrict to one IAM organization when configured. The org key differs per
+    // environment (dev seeds `edr_freight`, production uses the registered
+    // company key), so this is config rather than a constant. An unset key
+    // means no restriction; a key matching no organization matches no user —
+    // failing closed rather than silently widening to every org.
+    const orgKey = this.config.get<string>('FREIGHT_ORG_KEY');
+    if (orgKey) {
+      // EXISTS, not a join: a user with several employee rows would otherwise
+      // be returned once per row, duplicating them in the list and inflating
+      // `getManyAndCount`'s total.
+      qb.andWhere(
+        `EXISTS (
+           SELECT 1
+           FROM iam.employees emp
+           JOIN iam.organizations org ON org.id = emp.organization_id
+           WHERE emp.user_id = "user".id
+             AND org.key = :orgKey
+             AND org.deleted_at IS NULL
+         )`,
+        { orgKey },
+      );
+    }
+
     if (query.userType) {
       qb.andWhere('user.userType = :userType', { userType: query.userType });
     }